EASAPEnterprise agent assurance
Open referenceGitHub ↗Assess an agent
← All function guides Guide 03 · Risk, governance & audit

Make agent governance reviewable instead of interpretive.

Use EASAP to define the required evidence, accountable owners, approvals, retention, expiry, and revocation before a launch meeting.

BUILT FORAI governance, model risk, privacy, compliance, internal audit, and legal operations
What you will leave with
✓Risk classification
✓Control register
✓Approval matrix
✓Evidence retention policy
Your workflow
01

Set the decision boundary

Define the operating envelope: subject digest, permitted data, tools, users, geography, scale, expiry, and prohibited effects.

02

Separate inherent risk from control coverage

A safeguard does not erase the authority an agent receives. Track exposure and implemented controls as distinct facts.

03

Require inspectable evidence

Ask for sample size, uncertainty, traces, signatures, findings, approvals, and decision conditions—not a single benchmark score.

04

Govern change

Material changes should invalidate or narrow an earlier decision and trigger the appropriate regression suite.

Ready-to-use checklist
✓

The risk tier is tied to a documented authority model

✓

Control owners and approval roles are explicit

✓

Evidence retention and expiry are agreed before release

✓

Revocation and material-change rules are documented

HANDOFF TO THE NEXT FUNCTIONShare the assessment or probe ID, evidence requirements, open gaps, and scenario pack—not a screenshot.Revisit the EASAP model ↗